Processing of personal data in anti-doping policy:

Compatibility with EU Data Protection Regulation?

Summary: 1. Introduction. – 2. The scope of the provisions on doping of

the EU Regulation 2016/679: The specific problem of international data trans-
fers. – 3. Conclusions.

1. The processing of athlete´s personal data, in particular those

that are especially sensitive, such as obtained through biological sim-
ple analysis or personal health data, has been known as one of the
most controversial aspects of the anti-doping policy. This circum-
stance is aggravated by data transfers to States which are not mem-
bers of the European Union. In this context, it should be recalled
that World Anti-Doping Agency (WADA) is responsible for pro-
cessing that concern us, in addition to be located in Canada.
Given the situation, the recent adoption by European Union of
General Data Protection Regulation1 (hereafter, the ‘Regulation’) will
force us to raise the legality of such processing with respect to what
is established in the Regulation, as well as analyse the terms of its
possible compatibility with the consequent legal regime that, with re-
gard to guarantee this specific fundamental right, will be implemented
by EU Members States.
On the basis of a study of the provisions of the Regulation which
may affect anti-doping rules, we will analyse the scope of both the
data subject´s consent and the declaration of the objective of reduce
or eliminate doping from sport as an important public interest rea-

1
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th
April 2016, on the protection of natural persons with regard to the processing of per-
sonal data and on the free movement of such data, and repealing Directive 95/46/EC
(General Data Protection Regulation) (OJ, L119, 4 May 2016, p. 1 s.).

© Edizioni Scientifiche Italiane ISSN 1970-5611

236 Rassegna di diritto ed economia dello sport 2/2017

son. All of the above with the aim to demonstrate if those reasons
can be considered as exceptions for legitimate a transfer made with-
out European Commission adequacy decision or in the absence of
appropriate safeguards.
From this one derives a potential legality of the processing con-
cerned. However, this compatibility will depend on the final judg-
ment of the Court of Justice, based on the principles of necessity
and proportionality.
The Regulation could thus contribute to legitimate the current
anti-doping instruments, from the fundamental rights perspective. To
this end, the new EU law will establish a coherent system concern-
ing data processing control, although limited by its scope of appli-
cation.

2. The right to the protection of personal data is one of the rights

that are affected by the current instruments for combating doping in
sport. In this regard, the EU Court of Justice should have a major
role (from a European perspective and ultimately) to declare the le-
gality of international data transfers (i.e. to third countries or inter-
national organizations) in accordance with the provisions of the new
EU General Data Protection Regulation, which will be applied as of
25 May 2018.
In spite of the above, it must be recalled that the doctrine has al-
ready worked about this issue previously2, and the European Court
of Justice of Luxembourg has established the terms under which the
adequate protection of personal data should be evaluated in the con-
text of transfers to third countries or international organizations, as
well as in respect their final processing in the country of destination3.

2
Cfr., to that effect, R. Morte, Problemas de protección de datos de deportistas es-
pañoles en la actividad de la Agencia Mundial Antidopaje, in Revista Española de Dere-
cho Deportivo, 2, 26, 2010, p. 57 s.
3
European Court of Justice, 6th October 2015, c. 362/14, Maximillian Schrems c.
Data Protection Commissioner. On this judgment, cfr. L. Azoulai, M. van der Sluis,
Institutionalizing Personal Data Protection in Times of Global Institutional Distrust:
Schrems, in Common Market Law Review, 53, 5, 2016, p. 1343 s.; or F. Le Divelec,
Commentaire de Jurisprudence: Charte des droits fondamentaux – Protection des données
personnelles – Safe Harbor (Sphère de sécurité) Arrêt Schrems, in Revue du Droit de l´UE,
4, 2015, p. 673 s.

ISSN 1970-5611 © Edizioni Scientifiche Italiane

 D. Delgado Ruano / Processing of personal data 237

However, even considering those precedents (which must be as

obligatory reference to understand this question), we will focus now
on identifying dispositions that, contained in the new European Reg-
ulation, are concerned with the issue of anti-doping policy and its fit
with the system of human rights protection, at least within the scope
of European Union law. This with a view to defining the room of
manoeuvre of EU Court of Justice for the purpose of:
– recognize a hypothetical ‘horizontal’ application of the funda-
mental right concerned.
– declare the legality or illegality of the international data trans-
fer within the framework of anti-doping present policy and conse-
quently the compatibility, or not, with the European Union legal sys-
tem.
Well, the first thing that I would like to stress is that the Regu-
lation, following the evaluation criteria established by the EU Court
of Justice (and confirmed in its latest judgment about it, referred to
in footnote 3) in order to declare an international personal data trans-
fer according to the law, provides expressly such criteria, giving them
legislative force in its Article 45.2. As a result, the European Com-
mission shall be obligated to follow them when deciding if a third
country, a territory or one or more specified sectors within that third
country, or the international organization in question, ensures an ad-
equate level of personal data protection.
In particular, such safeguards are based on an assessment of the
following elements; these should not be interpreted as numerus clausus
system:
a) the rule of law, respect for human rights and fundamental free-
doms, relevant legislation, both general and sectoral, including con-
cerning public security, defence, national security and criminal law
and the access of public authorities to personal data, as well as the
implementation of such legislation, data protection rules, professional
rules and security measures, including rules for the onward transfer
of personal data to another third country or international organiza-
tion which are complied with in that country or international or-
ganization, case-law, as well as effective and enforceable data subject
rights and effective administrative and judicial redress for the data
subjects whose personal data are being transferred;
b) the existence and effective functioning of one or more inde-

© Edizioni Scientifiche Italiane ISSN 1970-5611

238 Rassegna di diritto ed economia dello sport 2/2017

pendent supervisory authorities in the third country or to which an

international organization is subject, with responsibility for ensuring
and enforcing compliance with the data protection rules, including
adequate enforcement powers, for assisting and advising the data sub-
jects in exercising their rights and for cooperation with the supervi-
sory authorities of the Member States;
c) the international commitments the third country or interna-
tional organization concerned has entered into, or other obligations
arising from legally binding conventions or instruments as well as
from its participation in multilateral or regional systems, in particu-
lar in relation to the protection of personal data.
However, the international transfer or a set of transfers of per-
sonal data can be executed in the absence not only of the European
Commission´s adequacy decision, but also of the appropriate safe-
guards mentioned in Article 46 of the Regulation4, including the bind-
ing corporate rules5. All this according to Article 49 of the Regula-
tion, establishing a number of exceptions for specific situations.
Well, one such situation calling for an exception in this regard is
the context where the transfer is necessary for important reasons of
public interest, as stipulated in the point (d) of the first paragraph of
the Article 49. In this way, it should be note that the recital num-
ber 112 of the Regulation expressly declares the objective of reduc-
ing and/or eliminating doping in sport as exception for that purpose.
A provision that cannot be exempted of the next and opportune
study.
Thus, its scope should be checked from two perspectives: first,

4
In practice, the safeguards could lead to: i) a legally binding and enforceable in-
strument between public authorities or bodies; ii) binding corporate rules in accordance
with Article 47 of the Regulation; iii) standard data protection clauses adopted by the
Commission in accordance with the examination procedure referred to in Article 93.2;
iv) standard data protection clauses adopted by a supervisory authority and approved by
the Commission pursuant to the examination procedure referred to in Article 93.2; v) an
approved code of conduct pursuant to Article 40 together with binding and enforceable
commitments of the controller or processor in the third country to apply the appropri-
ate safeguards, including as regards data subjects rights; or vi) an approved certification
mechanism pursuant to Article 42 together with binding and enforceable commitments
of the controller or processor in the third country to apply the appropriate safeguards,
including as regards data subjects rights.
5
These are regulated in Article 47 of the Regulation.

ISSN 1970-5611 © Edizioni Scientifiche Italiane

 D. Delgado Ruano / Processing of personal data 239

regarding its location in the Regulation, and second based upon the
strict material scope where to make transfer founded on the reason
explained.
As a result of the first appreciation, the fact that the reason of re-
ducing and/or eliminating doping in sport is reflected in the recitals
of the Regulation, leads to the conclusion that isn´t in the legislative
part and, therefore, has no the necessary binding legal force for it to
be directly invoked.
This could lead to future decision of EU Court of Justice to the
effect to declare it as derogation from the requirements for author-
izing international transfers of personal data to third countries or in-
ternational organizations. A decision which, ultimately, will be mo-
tivated by a predictable absence of unification of criteria between the
control authorities in each Member State, or by the knowledge of
the problem by the domestic courts, entailing the activation of the
preliminary ruling mechanism, under Article 267 TFEU. Further-
more, the EU Court of Justice should weigh the principles of ne-
cessity and proportionality to that effect.
On the other hand, from the analysis of the second question, a
negative consequence could derive for interest or objectives pursued
by responsible for world anti-doping policy. That´s because the aim
relating to reduce and/or eliminate doping in sport must also apply
(under recital 112) between services competent for social security mat-
ters or for public health. Thus, World Anti-Doping Agency does not
have that legal nature. It is therefore questionable the legality of those
transfers with destination WADA.
With regard to the above, support an international transfer of per-
sonal data to third countries – or international organizations – such
as those subjects to being considered medical data or being related
to health of athletes and, hence, be subject to special protection6, may

6
In this way, Article 9, first paragraph, of the Regulation prohibits – among others
– the processing of genetic data and the data concerning health, except that, according
its second paragraph, and for present purposes: i) the data subject has given explicit con-
sent to the processing of those personal data for one or more specified purposes, except
where Union or Member State law provide that the prohibition referred to in first para-
graph may not be lifted by the data subject; ii) processing is necessary for reasons of
substantial public interest, on the basis of Union or Member State law which shall be

© Edizioni Scientifiche Italiane ISSN 1970-5611

240 Rassegna di diritto ed economia dello sport 2/2017

be unfounded in light of the above explanation on exception con-

cerning important reason of public interest.
A problem that, a priori, could be solved through other deroga-
tion established in the same Article 49.1 of the Regulation and, specif-
ically, in its point (a). This is, in particular, that the person concerned
(i.e. the owner of the data) has given his explicit consent for the pro-
posed transfer, after having been informed of the possible risks of
such transfers for the data subject due to the absence of an adequacy
decision and appropriate safeguards.
Accordingly, either because a transfer is performed without the
corresponding adequacy decision and/or without the appropriate safe-
guards, according to one of reasons of the Article 49.1 of the Reg-
ulation, or because such reason – under point (a) of this rule – lacks
the explicit consent of the owner of the data and/or this person has
not been informed of the possible risks of such transfers, we would
be before a legal reality where proceed the horizontal effectiveness
of the Charter of Fundamental Rights of the European Union and,
particularly, of its Article 8, which it recognizes the right to data pro-
tection7.

3. In the light of the foregoing, I must defend a contrary posi-

tion to the legality of international transfers of personal data to World
Anti-Doping Agency, according to the new EU Data Protection Reg-
ulation.

proportionate to the aim pursued, respect the essence of the right to data protection and
provide for suitable and specific measures to safeguard the fundamental rights and the
interests of the data subject; and iii) processing is necessary for reasons of public inter-
est in the area of public health, such as protecting against serious cross-border threats to
health or ensuring high standards of quality and safety of health care and of medicinal
products or medical devices, on the basis of Union or Member State law which provides
for suitable and specific measures to safeguard the rights and freedoms of the data sub-
ject, in particular professional secrecy. These three derogations correspond to the points
(a), (g) and (i), of second paragraph mentioned, respectively.
7
Article 8 CFREU: «1. Everyone has the right to the protection of personal data
concerning him or her. 2. Such data must be processed fairly for specified purposes and
on the basis of the consent of the person concerned or some other legitimate basis laid
down by law. Everyone has the right of access to data which has been collected con-
cerning him or her, and the right to have it rectified. 3. Compliance with these rules shall
be subject to control by an independent authority».

ISSN 1970-5611 © Edizioni Scientifiche Italiane

 D. Delgado Ruano / Processing of personal data 241

In the context of the current world anti-doping policy, the con-

sideration – by the Regulation – of the objective to reducing and/or
eliminating doping in sport as important reason of public interest
which justifies derogation for an international transfer without Com-
mission’s adequacy decision, or without appropriate safeguards, can-
not be accepted by two reasons:
a) In these exceptional cases, under Article 49 of the Regulation,
the recipient of the data shall be a third country or an international
organization. It follows that other forms of organization, i.e. foun-
dation governed by private law, will be excluded of its scope of ap-
plication.
b) Because the consideration mentioned of important reason of
public interest is contained in the part of recitals of the Regulation
(specifically, number 112), and thus lack legally binding. In addition,
the illegality should also be corroborated, in the context of this recital,
by the fact that the exchange of data for this purpose must be made
between services competent for social security matters, or for public
health. In short, on areas of competence foreign to World Anti-Dop-
ing Agency.
Despite the above, a possible legality of the derogation could be
considered from the point of view of the consent. In other words,
the transfer would be valid on the condition that the athlete gives
his/her free and express consent for it, and after having been in-
formed of the possible risks of such transfers for the data subject
due to the absence of an adequacy decision and appropriate safe-
guards.
Further, it shall be up to the EU Court of Justice to evaluate (at
the time of declare the legality or not) the compatibility with the
principles of necessity and proportionality, not forgetting the con-
troversial issue of WADA´s legal nature.
David Delgado Ruano

Abstract
One controversial factor that has always been of interest in the anti-dop-
ing context is the international transfers of personal data, which are neces-
sary to combat doping in sport. However, European Union norms on per-
sonal data protection have become a challenge for the anti-doping organi-

© Edizioni Scientifiche Italiane ISSN 1970-5611

242 Rassegna di diritto ed economia dello sport 2/2017

zations located in EU Member States. In this sense, it must be interpreted

the scope of the provisions concerning doping of the new EU General Data
Protection Regulation, in order to determine the compatibility of the cur-
rent international transfers to World Anti-Doping Agency (WADA) with
the consolidated privacy EU legal order.

ISSN 1970-5611 © Edizioni Scientifiche Italiane

Copyright of Rassegna di diritto ed Economia dello Sport is the property of Edizioni
Scientifiche Italiane SpA and its content may not be copied or emailed to multiple sites or
posted to a listserv without the copyright holder's express written permission. However, users
may print, download, or email articles for individual use.